CVE-2026-68362 Overview
CVE-2026-68362 is a NULL pointer dereference vulnerability in the Linux kernel's ath11k Wi-Fi driver, which supports Qualcomm Atheros IEEE 802.11ax wireless devices. The flaw resides in the ath11k_hal_srng_access_begin function and is triggered through the QMI firmware ready event handling path.
The driver unconditionally sets the ATH11K_FLAG_REGISTERED flag during the ATH11K_QMI_EVENT_FW_READY handler, even when ath11k_core_qmi_firmware_ready() fails. This inconsistent state causes the subsystem restart (SSR) path to dereference uninitialized srng members, leading to a kernel crash.
Critical Impact
The vulnerability results in a kernel NULL pointer dereference that can crash the host system, causing denial of service on devices using the ath11k driver such as WCN6750-based platforms.
Affected Products
- Linux kernel versions containing the ath11k wireless driver prior to the fix
- Systems using Qualcomm WCN6750 hw1.0 AHB Wi-Fi hardware
- Additional Qualcomm 802.11ax chipsets serviced by the ath11k driver
Discovery Timeline
- 2026-08-10 - CVE-2026-68362 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-68362
Vulnerability Analysis
The defect exists in the ath11k QMI event handling logic within the Linux kernel wireless subsystem. When the driver processes an ATH11K_QMI_EVENT_FW_READY event, it calls ath11k_core_qmi_firmware_ready() to complete firmware initialization. The driver then sets the ATH11K_FLAG_REGISTERED flag regardless of whether that initialization actually succeeded.
When firmware ready processing fails, the driver reports initialization as complete while critical hardware resources remain uninitialized. During a subsequent subsystem restart (SSR), the driver traverses the recovery path based on this false state. The restart path invokes ath11k_ce_cleanup_pipes(), which calls ath11k_hal_srng_access_begin() on srng (Source Ring) structures that were never initialized.
The resulting call trace observed on WCN6750 hw1.0 AHB hardware shows:
- ath11k_hal_srng_access_begin+0xc/0x60 [ath11k]
- ath11k_ce_cleanup_pipes+0x17c/0x180 [ath11k]
- ath11k_core_restart+0x40/0x168 [ath11k]
Root Cause
The root cause is missing error handling in the QMI firmware ready event path. The ATH11K_FLAG_REGISTERED flag is set unconditionally before verifying that ath11k_core_qmi_firmware_ready() completed successfully. This creates a driver state where registration is signaled but internal ring buffers remain unallocated, violating the invariants expected by the SSR restart code.
Attack Vector
Exploitation requires the firmware ready sequence to fail on a system using the ath11k driver. A subsequent SSR event then triggers the NULL pointer dereference. The condition is primarily reachable through firmware initialization faults or induced restart scenarios on affected Qualcomm wireless hardware. The impact is a kernel crash, causing denial of service on the host system.
Refer to the upstream kernel commits for the specific code changes that address the flaw. See Kernel Git Commit Fix for the primary patch.
Detection Methods for CVE-2026-68362
Indicators of Compromise
- Kernel oops or panic entries in dmesg referencing ath11k_hal_srng_access_begin, ath11k_ce_cleanup_pipes, or ath11k_core_restart
- Repeated ath11k firmware initialization failures followed by subsystem restart events
- Unexpected loss of Wi-Fi connectivity on systems using Qualcomm WCN6750 or related ath11k-supported chipsets
Detection Strategies
- Monitor kernel logs for ath11k error messages indicating ath11k_core_qmi_firmware_ready failure combined with the ATH11K_FLAG_REGISTERED flag being active
- Track kernel version and module inventory across Linux endpoints to identify hosts running vulnerable ath11k builds
- Correlate wireless driver restart events with subsequent kernel crash dumps
Monitoring Recommendations
- Forward kernel logs and crash dumps to a centralized logging platform for review
- Alert on repeated Wi-Fi subsystem restarts on Linux systems with Qualcomm 802.11ax hardware
- Track deployed Linux kernel package versions against upstream stable releases containing the fix
How to Mitigate CVE-2026-68362
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the stable tree commits to systems running the ath11k driver
- Prioritize patching for platforms using Qualcomm WCN6750 hw1.0 AHB and other affected 802.11ax chipsets
- Reboot updated systems to ensure the patched kernel module is loaded
Patch Information
The fix skips firmware ready handling when ATH11K_FLAG_REGISTERED is already set, sets that flag only when ath11k_core_qmi_firmware_ready() succeeds, and sets ATH11K_FLAG_QMI_FAIL while aborting FW_READY handling on error. The change was tested on WCN6750 hw1.0 AHB WLAN.MSL.2.0.c2-00204-QCAMSLSWPLZ-1. Patches are available in the stable kernel tree: Kernel Git Commit Change, Kernel Git Commit Update, Kernel Git Commit Fix, Kernel Git Commit Patch, and Kernel Git Commit Improvement.
Workarounds
- Unload the ath11k module (modprobe -r ath11k) on systems that do not require Wi-Fi functionality until the kernel is patched
- Disable the affected wireless interface where wired connectivity is available
- Restrict administrative access on affected hosts to reduce the likelihood of induced restart conditions
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
